Data deletion Inspections

Overview

UK Biobank is a large-scale biomedical database and research resource containing genetic, lifestyle and health information from around half a million UK participants. UK Biobank's database, which includes blood samples, heart and brain scans and genetic data of the 500,000 volunteer participants, is globally accessible to approved researchers who are undertaking health-related research that's in the public interest. Protecting the confidentiality and security of participant data is UK Biobank's highest priority. Before a recent widely reported data incident, UK Biobank was undertaking a phased transition from a data download model to a more secure, platform-by-default access model through the UK Biobank Research Analysis Platform (UKB-RAP), in line with principles of a Secure Data Environment approach. The data incident has resulted in the acceleration of the delivery and implementation of technical and operational controls that were in development, principally the introduction of an automated checking system to prevent de-identified participant data being egressed from the research analysis platform. As part of addressing the legacy data download model, UK Biobank is working to complete the transition and ensure outstanding downloaded data are deleted. Affected researchers are being contacted to complete this work, and UK Biobank intends to procure services from two independent third-party organisations to report on the researchers' data deletion position. UK Biobank issued a UK5: Transparency notice - Procurement Act 2023 for this award which was published on 7 August 2026. UK Biobank intends to award the contracts directly to suppliers that are not excluded suppliers pursuant to section 41(1)(a) of the Procurement Act 2023 and on the basis of extreme and unavoidable urgency. UK Biobank has conducted a thorough investigation into a recent widely reported incident whereby de-identified data relating to UK Biobank participants was purportedly listed for sale on a consumer website in China. The purported sale was a clear breach of the contractual commitments made by approved researchers who had legitimate access to UK Biobank's biomedical database. UK Biobank provides approved researchers with access to the de-identified data contained in its database via its secure research analysis platform which was (and remains) suspended following the incident. As part of a series of measures to prevent further misuse of de-identified participant data and reassure participants that their data is safe and secure, UK Biobank is enhancing its systems including accelerating the development of an automated checking system to prevent de-identified participant data being egressed from the research analysis platform. UK Biobank intends to enter into contracts with KPMG and BSI respectively to contact the research institutions which previously accessed UK Biobank's biomedical database, obtain relevant information and evidence around the deletion of UK Biobank's data on completion of their research in line with their contractual obligations. It is necessary for reasons of extreme and unavoidable urgency that the contracts to obtain evidence, review and report on the data deletion status of (in aggregate) projects of ~1,000 relevant institutions are entered into without delay and therefore a competitive tendering exercise cannot be undertaken. This exercise will give UK Biobank a better picture of the security of participant records used in completed and ongoing projects and assist UK Biobank to resume its focus on allowing safe and secure access to researchers worldwide to conduct vital research into the diagnosis, prevention and treatment of diseases.